The OpenClaw Security Saga: How AI Adoption Outpaced Security Boundaries
ID: bf6987f6-b7b8-5830-ac0a-1eaf18bd4817
STIX ID: report--bf6987f6-b7b8-5830-ac0a-1eaf18bd4817
Feed Name: Cyera Research Labs
The report details how the OpenClaw AI-agent ecosystem has blurred boundaries between personal projects and enterprise infrastructure, enabling large-scale aggregation of OAuth tokens, API keys, and high-privilege SaaS permissions; it documents ~24,478 internet-exposed instances, marketplace analysis showing numerous over-permissioned skills, a coordinated malicious campaign (ClawHavoc) distributing trojans/infostealers, CVEs and public PoCs, widespread misconfigurations (including leaked API keys on Moltbook), and the high risk of indirect prompt-injection leading to automated data exfiltration across email, cloud, and collaboration platforms.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.